Security

By April 2nd, 2019 Uncategorized

RAVE takes security very seriously.

We want to be sure that our customers have the most knowledge and up-to-date information regarding security and this most recent threat. RAVE participated in on an Intel webinar recently dedicated to this issue. Vulnerabilities affect all silicon vendors across the entire industry – but this does not affect the integrity of the processors.


There are many things to be aware of that are important for everyone to know and acknowledge.
  • First, this is a local attack, not a network attack.  But Malware has to get onto system somehow.  Intel has seen proof of concept demonstrated on several systems. Weaponized POC code for Meltdown (Variant 3) and Spectre (Variant 1+Variant 2) have both been posted publicly.  Intel is not aware of any code which has attacked a system.
  • What it is:  A method for an attacker to observe contents of privileged memory, circumventing expected privilege levels.
    Malware using this method and running locally could expose sensitive data such as passwords and encryption keys.
  • What it isn’t: A denial of service attack.
    A network attack.
    A means to inject malicious code or corrupt memory.

Security issue variants.

Intel’s Approach.

From Intel: Intel is committed to improving the overall security of computer systems through hardware and software.  A new series of side-channel analysis methods have been discovered that potentially facilitate access to unauthorized information. These methods rely on common properties of both high-performance microprocessors, modern operating systems and susceptibility is not limited to Intel processors, nor does it imply the processor is working outside its intended functional specification.

Intel is taking a comprehensive approach to provide the most secure platforms. This includes a combination of operating system and firmware updates, developed in collaboration with industry partners, operating system vendors, and OEMs.  They expect mitigation will be available to users beginning over the next few days and continuing over several weeks.

Intel is releasing new microcode for their CPUs at a rate of 5-10 per day at this time. Fortunately, the original Atom and Itanium are not impacted, but nearly every other processor is impacted- desktop, server, IOT, etc is. Intel has decided to avoid risk and release fixes for all CPUs going back 10 years. Additionally, an OS update required to leverage the new microcode.

Intel will release information to all need-to-know entities and to anyone else who can do something about it. The target date for disclosure was Jan 9th, aligned with M$ Patch Tuesday.  They had been working with their OSV’s on the fixes for many months.

From the Intel webinar: Disclosure date (Google Project Zero) was pushed out which is unprecedented. Google Project Zero is autonomous, not directly controlled by Google or Alphabet. An industry-wide collaboration to facilitate responsible disclosure with mitigation options will need to happen to resolve the issue. Additionally, as Intel started putting mitigations in place, Intel realized more companies are involved, this includes ARM and AMD. All of the mitigation methods take advantage of speculative execution, a common technique in processors used to achieve high performance. Intel is working closely with ecosystem partners, as well as with other silicon vendors whose processors are affected, to design mitigations for these methods.


Performance.

According to Intel, the performance impact is low to mid single-digit percentage impact when all CPU+firmware+OS are all updated. Performance impact can be low double digits in corner cases and reports of higher performance hits are questionable and preliminary. Intel is not finished reviewing processors and developing new microcode, this may take from 2 years to 2 quarters. Microcode can be turned on or off as programs are running – as ISV’s come up to speed, perf hits should decrease, be minimized. Intel is targeting to implement fix for Variant 2 in silicon in all future products by end of 2018.


What is specifically affected.

While Intel is still debugging, the following processors are presumed effected:
2017: Coffee Lake
2016: Kaby Lake, Goldmont
2015: Skylake
2014: Broadwell
2013: Haswell, SIlvermont
2012: Ivy Bridge
2011: Sandy Bridge
2010: Westmere
2008: Nehalem, Silvermont
2006: Intel Core
2004: Prescott
2003: Pentium M
2000: Netburst (Pentium 4)
1999: P6 (Pentium III)
1995: P6 (Pentium Pro, later Pentium II)
1993: P5 (Pentium)


More specifics.

Google Project Zero identified the Spectre initially. Meltdown = Variant 3, identified by an independent researcher later. Also resulting in: Kernel Page Table Isolation (Kaiser) = Meltdown = Rogue Data Load. Variant 1 & Variant 2 can’t be mitigated by Intel alone – and both require software (OS) update. Again, this is not because of a bug or flaw in the CPUs.

How this came to be released early – some information was released by another silicon vendor in a debug effort and leaked to WSJ, who wrote an article. Prior to the release of the article the WSJ contacted Intel to ask if they wanted to add a comment to their article. At that time they reviewed the information and found false information, as a result, Intel decided to make a statement.


Below are several links supplied by Intel that can provide more information.

Intel whitepaper: Intel Analysis of Speculative Execution Side Channels
Get the facts about the new security research findings and Intel products.
See the latest news from Intel.
Learn more about the issue on the Google* Security Blog.
Speculative Execution and Indirect Branch Prediction Side Channel Analysis Method

 

These sites provide a summary of the issue, overview of platforms affected, and recommendations for mitigation.

Intel Security Center site: https://security-center.intel.com

Intel Security Response Team site:

https://01.org/security/advisories/intel-oss-10002

https://01.org/security/advisories/intel-oss-10003